1. Field of the Disclosure
The present disclosure relates to a servo system, a servo motor driving device, a safety unit and a method for controlling a servo system.
2. Background Information
Servo systems are used for positioning control of movable portions of various machines, for example. An example of such a servo system includes a servo motor for operating various types of mechanical equipment, an encoder attached to the servo motor, a servo driver for driving the servo motor, and a control device for outputting position instruction information or the like to the servo driver.
Recently, along with reducing costs and improving productivity, taking measures to assure safety for workers has become an important issue in the manufacturing scenes. For this reason, there has been an increased demand for servo systems as described above to comply with safety standards. IEC61800 was established as a safety standard for adjustable speed electrical power drive systems such as systems provided with a servo motor.
Part 5-2 of IEC61800 (hereinafter referred to as “IEC61800-5-2”), which was issued in July 2007, stipulates safety requirements in terms of functions, namely, requirements regarding a safety motion function.
Also, IEC61508 is also established as such a safety standard. IEC61508 is international standards regarding the functional safety of electrical/electronical/programmable electronic safety-related systems. In IEC61508, the failure probability of a system is stipulated by a scale called SIL (Safety Integrity Level). Requirements to be satisfied are defined for each SIL, thereby clarifying issues to be fulfilled by the safety control system to be constructed. SIL is made up of four levels, SIL1 to SIL4, and SIL4 is the highest level. IEC61800-5-2 also adopts SIL in evaluation of the safety level of system construction.
In order to assure safety in a system including a servo motor, it is necessary that an encoder precisely detects the rotational speed, rotational position or the like of the servo motor. For this purpose, there has been a demand for assuring reliable encoder outputs. There is also a demand for countermeasures, such as stopping supply of electricity to the servo motor when the detection result from the encoder is abnormal.
The easiest method for assuring reliable encoder outputs is to provide the encoder with redundant (e.g. duplicate) internal circuitry and thereby verify that the output data from the encoder is correct. Also, in the case of an encoder of the SIN/COS type in which sine (SIN) signals and cosine (COS) signals are generated, a method is also known in which it is proved that two mutually independent SIN and COS systems are constantly in a predetermined relation based on the relation SIN2+COS2=1.
For example, JP H11-514091A discloses a measurement system including two mutually independent encoders of SIN/COS type.
Also, for example, “Position Measurement System Complying with Safety Requirements”, March 2008 (online) (searched on Feb. 18, 2010), Internet URL:http://www.heidenhain.jp/file_admin/pdb/media/img/596632-J1.pdf discloses a method for generating two mutually independent positional data sets by simultaneously performing scanning inside the encoders. With this method, two positional data sets are sent to a monitoring device provided on the safety control side. The monitoring device compares the two positional data sets to each other, and sends these two positional data sets and an error bit independent thereform to the safety control side. On the safety control side, it is regularly monitored whether the position measurement system complying with safety requirements operates properly.
If two independent encoders are installed, an installation area that is twice as large as that required in the case where one encoder is installed is required. In addition, the cost of the system increases as the number of encoders increases. Moreover, in order to realize highly accurate detection, the initial settings of the two encoders should be carried out strictly so that the detection values of the two encoders do not deviate from each other. However, additional time and costs for the initial settings of the encoders are necessary. Also, when the two encoders have the same circuitry, common failures may occur in these encoders.
Also, if an encoder is used in which two mutually independent positional data sets are generated, such as the encoder of the SIN/COS type, or if two mutually independent encoders are used as described above, feedback control with the use of two data sets may be complicated. In addition, since the circuitry is configured to generate two data sets with one encoder, the cost for the encoder may increase.
Furthermore, an encoder of the SIN/COS type generally outputs analog signals. When the transmission distance of an analog signal is long, the signal tends to attenuate or be affected by noise, and thus the reliability of the detection value decreases. In order to avoid such issues, it is desirable for the encoder to have a function of sending digital values.
However, in order to prove that a logic for communicating digitally complies with safety requirements, the logic has to be manufactured with the development procedure stipulated in IEC61508. Specifically, a component that outputs a plurality of signals for diagnosing failures in the encoder is necessary. Conventionally, safety control systems were constructed using an encoder developed especially for this purpose. Accordingly, replacing an existing system with a system that complies with safety standards required extensive modifications of the system.